PowerBI in AP: Implement requirements for PowerBI Gateway

[julialawrence]

(Can be done at the same time as #2451 but it would be better if #2451 was done first)

User Story

As a…
As an AP customer, I would like to publish visualisations based on AP data via the PowerBI service.

Value / Purpose

PowerBi is the preferred tool for this purpose across MOJ and has a high rate of adoption across the org, so being able to use it would improve AP customers' experience.

Useful Contacts

@julialawrence

User Types

AP Customers

Proposal

This story captures the implementations of the publishing workflow drawn here: https://mojdt.slack.com/archives/C062MEEF5SQ/p1699457775225609?thread_ts=1699456879.652999&cid=C062MEEF5SQ

Components to create are as follows:

• Windows EC2 instance with outbound internet connectivity to host the PowerBI Gateway Application
• Instance profile with an IAM policy that has the same permission as the master author alpha role plus ability to connect via SSM.
• A service account or application to authenticate with PowerBI service and share the Gateway.

This task will also need to resolve the complication outlined here: #2451

Additional Information

The workflow mentions a critical assumption that all readers/authors of the report have the same set of permissions. This assumption isn't correct, however, the requestor will appoint a master author of the report who will have access to the full data and then will utilise capability native to PowerBI to partition the report with smaller subsets of data. As members of the DPAT team, we are not implementing that portion of the solution: that will sit with the customer.

Out of scope: High Availability out of scope.

Definition of Done

• Build Windows VM to host PowerBI Gateway (in analytical-platform-data-production)
• Define instance profile for the Gateway VM that has the same permissions as the IAM policy defined in 📉 PowerBI in AP: Implement requirements for PowerBI Desktop #2451 + allows access via session manager
• Install and configure PowerBI Gateway application (bootstrapped in code preferable, manual configuration acceptable)
• Agree approach to authenticate the gateway with PowerBI service
• Test authentication and sharing of the gateway with PowerBI service
• Test with customer

[Gary-H9]

Work on the GitHub team is in here.

[jacobwoffenden]

manual e2e testing has been complete in #3130

[BrianEllwood]

currently in use